KB5062553 and Windows Secure Boot certificate expiration

Microsoft released update KB5062553 for Windows 11 version 24H2 on July 8, 2025.

KB5062553 was previewed on June 26, 2025. KB5060829 It also includes feature updates and fixes for known issues.

KB5062553 mainly fixes the following three issues:

• [Graphics] Fix: This issue occurs only if the June 2025 non-security update (KB5060829) is installed. If the game resolution does not match the desktop resolution, the game content and cursor position may become out of sync when switching certain games into full-screen exclusive mode with ALT+TAB and then returning to the game.
• [Multimedia] Fix: This update fixes an issue that could prevent notification sounds from playing. Affected sounds include on-screen alerts, volume adjustments, and sign-in sounds.
• [Windows Firewall] Fix: This update addresses an issue in which Windows Firewall with Advanced Security logs Event 2042 in the Event Viewer. The event appears with the message "Failed to read configuration" and "More data available." For more information about this issue, see "Windows Firewall Error Event Logged" in the Windows Health Dashboard.

ecosystem – Google Translate

In addition to the above three, currently KB5062553 If you look at the page, the section on known issues states, "Microsoft is not currently aware of any issues with this update." There is no mention of the "Noto font issue," which has been an issue for some time.

Although KB5062553 has not been officially released, it appears to also fix the "Noto font issue."

I checked my environment after installing KB5062553, and no particular problems occurred.

Windows Secure Boot certificate expiration date

Two,KB5062553 Some of you may have noticed at the beginning of this page that "The Secure Boot certificates used on most Windows devices will expire in June 2026."

Windows Secure Boot certificate expiration date

Important: The Secure Boot certificate used by most Windows devices will expire starting in June 2026. If not renewed in time, this may affect the secure boot of some personal and business devices. To avoid confusion, we recommend reviewing the guidance and renewing your certificates in advance. For more information and preparation steps, see Windows Secure Boot certificate expiration and CA renewal.

ecosystem – Google Translate

Some people may be worried about whether they need to do anything or whether Windows will stop booting after the expiration date, but there is no need to worry if you are using Windows 11 at home.■

According to Microsoft:

If you have a Windows 10 or Windows 11 device running the Home, Pro, or Education edition and you get updates automatically from Microsoft (like most users), then yes, this applies to your device. 

This means that the new certificate will be delivered (automatically updated) to each device through the normal Windows Update.

Therefore, most users do not need to take any special action. 

However, this requires that Secure Boot is enabled.

How to check if Secure Boot is enabled

1. Press Windows key + R to open Run, type "msinfo32" and press Enter.

2. System Information will open, so check the right side of Secure Boot Status.

* Windows may become unable to start when updating the Windows Secure Boot certificate.

Microsoft states the following about what can happen when renewing Windows Secure Boot certificates:

Unfortunately, in some cases, the device may no longer boot or may experience a BitLocker recovery situation when a new certificate is received.

This means that when the Windows Secure Boot certificate is updated (after Windows Update is complete), Windows may not start or the BitLocker recovery screen may appear.

The problem for users is that they don't know when the certificate will be renewed. Will it be just before the expiration date or will it be renewed much earlier?

According to Microsoft:

The rollout of the new certificates will continue in phases until June 2026. Microsoft will begin with Home and Pro edition systems to ensure a smooth and secure transition.

If you encounter a problem, there are two options:

• Disable Secure Boot if Windows won't boot
  • If you have any issues disabling Secure Boot, we recommend contacting your manufacturer.
• When the BitLocker recovery screen appears, enter your 48-digit recovery key.

How to find your BitLocker recovery key

If you sign in to Windows with a Microsoft account, your recovery key will be stored in your account when you turn on BitLocker.

1. In your browser Microsoft アカウントSign in to your Apple ID and open "Devices" > "Info & Support" for the device you're currently using.

Please sign in using your smartphone, another PC, an internet cafe, etc.

2. Under BitLocker Data Protection, click Manage Recovery Keys.

3. Your BitLocker recovery key will then be displayed.

The "Key ID" is the first 8 alphanumeric characters of the recovery key ID displayed on the BitLocker recovery screen. The recovery key to the right of it is the 48-digit BitLocker recovery key.

I guess that the reason why Windows cannot start is because of theSince June 10th and 11th, 2025, PCs from certain manufacturers (such as GIGABYTE, Fujitsu, and Mouse) running Windows 10 or Windows 11 have been unable to boot after a Windows Update."Is it possible that this only occurs with certain manufacturers, just like with the "

Regarding BitLocker recovery, it may appear in any environment where BitLocker is enabled.

The next page also introduces how to prevent BitLocker from being enabled automatically. In the past, there have been issues with BitLocker being enabled automatically in multiple user environments, so please refer to this if you are concerned.

Why does "BitLocker Recovery" appear on Windows 10/11 Home?

【Related Links】

• [Independent Verification] Will the Secure Boot issue brick your graphics card in 2026? We asked official Microsoft support directly.
• [Warning] BIOS manipulation can make your PC unbootable? Three measures to prepare for Secure Boot updates
• How to check the version and expiration date of Windows Secure Boot certificate